21 réponses à ce sujet

[Tyrax Lightning]

I tried to download the Elf Mage Poster Girl poster & a virus window tried to sucker me! I know it's a virus because i'm ashamed to admit that i've fallen for it once before & my puder was toast in less than 2 minutes afterwards & I had to fdisk.

It's a false Adobe Acrobat Reader window, & it showed up on the Elf Mage Poster Girl screen after I clicked 'Download'. I figured ya would wanna know because it needs to be exterminated. Noone is gonna wanna go what I went through before.

Modifié par Tyrax Lightning, 30 novembre 2009 - 04:46 .

[Jesse van Herk]

Please PM me with the URL of the page you saw this on. The main Dragon Age website (dragonage.bioware.com) doesn't have anything such as a "poster girl" feature, but even if it's on another site we would like to know. Thanks.

Modifié par Jesse van Herk, 27 novembre 2009 - 07:36 .

[Tyrax Lightning]

It was here:

http://dragonage.bio...gallery/posters

Then I clicked the left-hand list to select the Elf Mage, (I call her the Elf Mage Poster Girl, since she doesn't seem to have any actual designation/name.) then clicked 'DOWNLOAD POSTER Click to Download' because I was curious about whether or not I could find a use for the poster download. When it's clicked, a pop-up for Adobe Acrobat Reader pops up.

I refuse to click it, because on a different site a couple months ago, during wallpaper surfing, I clicked a Adobe Acrobat Reader pop-up window that looks exactly like this one & I fell for it, thinking my Acrobat Reader musta gotten outta date & seconds afterward, my McAfee was suddenly assaulted by a storm of Trojans. McAfee blocked most of them, but 2 of those trojans breached the McAfee, & those 2 trojans alone overkilled my puder & compromised my ability to operate my programs anymore, so I had to fdisk.  

I'm never clicking an Adobe Acrobat Reader pop-up ever again, because there seems to be no way at all to tell if it's legit, or a virus trap.

Please fix if ya can duplicate it.

Another note: I was <Bleep>ed at that virus defeat afore-mentioned & from now on, in my IE8 (no Google Chrome) Internet Options, I now set it's pop-up blocker to Full. This pop-up shows up when ALL pop-ups are supposed to be blocked. What hope could there be of it bein legit?

[Eshme]

With my limited knowledge, id say your browser is to blame. The Poster is in PDF (acrobat) format, and its your browser attempting to find a reader for it.

Either that, or the browser is already corrupted by something else. Which is more likely. Given that the popup is a repeat.

Take note that legit browsers are neutral. Hope is the wrong word for it.

[Forsakerr]

yeah the poster is in pdf format , no virus in there

[Tyrax Lightning]

Anyone know any way to tell a real Adobe pop-up from a virus one then?

[Forsakerr]

get an free anti virus and dont go on porn or shady sites and you ll never get any virus , the last virus i got was years ago when just plugging your windows xp (without any SP installed) on the net caused it to get it

Modifié par Forsakerr, 28 novembre 2009 - 11:51 .

[CyberMaxX]

Forsakerr wrote...

yeah the poster is in pdf format , no virus in there

FYI: 
Honestly some fact checking before posting an opinion on something being reported as a potential virus source would be nice. 

Perhaps anyone reading this should frequent Adobes own site  www.adobe.com/support/security/    for security issues reportedly in the wild that exploits their software. 

As of Oct. 8, 2009 there is a known flaw "Bulletin: ASPB09-15" in the wild with which exploits Adobe Reader using .PDF files as the container and as of Oct. 13, 2009 Adobe was quick enough to put out a fix.

Since at least 2001 see:  news.cnet.com/New-virus-travels-in-PDF-files/2100-1001_3-271267.html  .PDF files have been known to be used as a containers for viruses and malicious software mostly exploiting Buffer Overflows in Adobes own Acrobat Software.

Good advice for anyone reading this post:

1) Make sure you have a decent Anti-Virus application running and one that is always up-to-date.
2) Make sure your Browser and Operating System are always up-to-date with the latest Security patches and Fixes.
3) Make sure that your "Helper" applications such as - Adobe Reader, Adobe Flash, MP3 Players, Picture Viewers, Video Players and/or anything else that maybe on your system capable of openning any downloaded file from within your browser are current and up-to-date.
4) If you install software from a well known vendor and it has a feature to automatically check and apply fixes from the internet, then by all means let the software do just that. 
5) Playing games on your PC is all fun and such, but hey... do yourself and the rest of the world a favor and take some time off once in a while to maintain your system.  Instead of Playing a few hours, surf and apply fixes and patches to your software.
6) Don't assume that because a file is of such nature that it isn't an executableby itself that it is immune from being a host for a Virus or piece of malicious software.  Simple .JPG files have been known to carry them as well.

If you find this hard to believe then Google Malicious JPG or Malicious PDF and you'll find all sorts of listings.

Cheers
CyberMaxX

Have fun, but be safe.

EDIT:
Seriously Check Facts before posting - it's not just "Porn" sites that one may receive a virus from.  
Would you consider the NY Times site a Porn related site? 
They where hit recently see: news.cnet.com/8301-1009_3-10351460-83.html

Are people really that oblivious of what's reality in this world when it comes to Viruses and the Internet. 
What's with all these misconceptions - Wake up people.

 

Modifié par CyberMaxX, 28 novembre 2009 - 11:53 .

[Forsakerr]

CyberMaxX wrote...

Forsakerr wrote...

yeah the poster is in pdf format , no virus in there

FYI: 
Honestly some fact checking before posting an opinion on something being reported as a potential virus source would be nice.  


 

FYI:
i checked before posting and my anti virus never triggered so i replyed saying it did nt contain any virus after looking at the poster on my destop

[CyberMaxX]

Forsakerr wrote...

CyberMaxX wrote...

Forsakerr wrote...

yeah the poster is in pdf format , no virus in there

FYI: 
Honestly some fact checking before posting an opinion on something being reported as a potential virus source would be nice.  


 

FYI:
i checked before posting and my anti virus never triggered so i replyed saying it did nt contain any virus after looking at the poster on my destop

Stating that it "is in a .pdf format and no virus in there" leads one to believe that because its a PDF there is no reason to be concerned.  Perhaps stating that you checked the file in question and that your virus scanner didn't detect a virus would have been the proper wording.  But, then again, not all virus scanners catch everything one may and another may not. 

Like I stated, everyone's best bet is to stay up-to-date with security patches and fixes for any software they use to open files, as well as their Operating Systems and Browsers.

Cheers
CyberMaxX

[Tyrax Lightning]

I use McAfee. It & my Windows Update are set to auto-check for updates, & my McAfee is set to auto-virus scan every day.

One reason i'm concerned about the Adobe Reader window is because it showed up on a wallpaper site while I was wallpaper surfing & the site had a green safe label from my McAfee SiteAdvisor. That together with my figuring it had been awhile since I had done anything with Adobe Acrobat Reader made the pop-up seem safe. (At this time, my IE8 Browser Internet Options pop-up blocker was set at 'most'.) I clicked the pop-up figuring maybe my Adobe Acrobat Reader had gotten outta date & was about to be updated. Suddenly McAfee was blocking a storm of Trojans. Like I said in my 2nd post, 2 of the Trojans breached my McAfee's blocking attempts & my puder was toast about 2 minutes afterward. I had to fdisk. This virus defeated McAfee. The Adobe Acrobat Reader pop-up that showed up on that DA:O Poster website looks EXACTLY the same as the one that caused my last fdisk.

I now use 'Full' pop-up blocker, but it still doesn't block Adobe Acrobat Reader window pop-ups, & I don't dare ever trust them again. I X those windows & full virus scan upon encounter.

Also take note, I NEVER surf porn. I do wallpaper surf, & I don't dare do even that without McAfee SiteAdvisor backup, even after it's managed to fail me once before. Sadly, i'm still not better off without it.

@CyberMaxX: Many thanks for the Adobe link. When I have time, i'm gonna use it & see if I can learn more about the Acrobat Reader.

Modifié par Tyrax Lightning, 29 novembre 2009 - 12:43 .

[Eshme]

Just download it yourself from a save location like adobe.com.



The Poster on Biowares site is just fine. Although makes a bad Wallpaper if its in PDF format if u think about it hah.

[Tyrax Lightning]

Eshme wrote...

Just download it yourself from a save location like adobe.com.

The Poster on Biowares site is just fine. Although makes a bad Wallpaper if its in PDF format if u think about it hah.

My poster use I was thinkin of wasn't for Wallpaper. I already know there's a seperate wallpaper section. I got a couple of those wallpapers myself. Actually, I was considering cutting stuff outta various pics to experiment on combining them into a sig pic, cause i've always been curious about whether or not I could figure out how to make one.

[Eshme]

np do what u fancy once u have it

[CyberMaxX]

Tyrax Lightning wrote...

I use McAfee. It & my Windows Update are set to auto-check for updates, & my McAfee is set to auto-virus scan every day.

Cheers on that

I now use 'Full' pop-up blocker, but it still doesn't block Adobe Acrobat Reader window pop-ups, & I don't dare ever trust them again. I X those windows & full virus scan upon encounter.

Quite a few things fly under the Popup Blocker Radar now a days..
see here for good advice: netsecurity.about.com/od/popupsandspyware/qt/aaclosepopup.htm

Under the IE8 "Popup Blocker Settings Window" - check the list of "Allowed Sites", see if there maybe something listed that you don't recognize if so remove it/them.

I'm running XP SP3 and IE8
If I visit the Dragon Age Origins - Gallery/Poster section using IE8 with it's Popup settings set to Medium... and click the "Click to Download" link under the DOWNLOAD POSTER [splat], I'm alerted by IE8 that it blocked a Popup Window.  If I then select "Temporarily Allow the Site" then what I get is a Second IE8 Window with an Embedded Adobe Acrobat Frame along with the Poster being displayed.   This is what I would consider Normal circumstances for the site.

Which leads me to wonder if you are getting some kind of popup other then that - It may be possible that perhaps the .PDF extension is somehoe being hijacked from under IE8.  (Don't know how this maybe if you fdisk'd your drive. Did you perform a Fresh install of everything again or did you recover your system after the fdisk from perhaps a backup?
 
Couple of tests - if you click on a .PDF file that is already stored on your computer does it open the Adobe Acrobat Reader? or does this popup window activate itself?.  What's the exact wording of this popup window.

Another Check - On IE8's Menu bar look under "Tools" and select "Manage Addons".
A configuration window should start, select under the section marked "Add-on Types" the button for "Toolbars and Extensions" (Should Default to this button).  Look at the frame to the right and find "Adobe PDF Link Helper" and ensure that it is enabled.

If you feel that perhaps somthing may have hijacked your system, I would suggest visiting the bleepingcomputer.com site (yea I know it sounds like a crazy name, but  a lot of folks there can help).
On their Home page they give you the steps you need to follow in order to expedite your help question to the masses.

@CyberMaxX: Many thanks for the Adobe link. When I have time, i'm gonna use it & see if I can learn more about the Acrobat Reader.

No problem, and glad to help.

Cheers
CyberMaxX

[Tyrax Lightning]

CyberMaxX wrote...

I'm running XP SP3 and IE8
If I visit the Dragon Age Origins - Gallery/Poster section using IE8 with it's Popup settings set to Medium... and click the "Click to Download" link under the DOWNLOAD POSTER [splat], I'm alerted by IE8 that it blocked a Popup Window.  If I then select "Temporarily Allow the Site" then what I get is a Second IE8 Window with an Embedded Adobe Acrobat Frame along with the Poster being displayed.   This is what I would consider Normal circumstances for the site.

Which leads me to wonder if you are getting some kind of popup other then that - It may be possible that perhaps the .PDF extension is somehoe being hijacked from under IE8.  (Don't know how this maybe if you fdisk'd your drive. Did you perform a Fresh install of everything again or did you recover your system after the fdisk from perhaps a backup?
 
Couple of tests - if you click on a .PDF file that is already stored on your computer does it open the Adobe Acrobat Reader? or does this popup window activate itself?.  What's the exact wording of this popup window.

Another Check - On IE8's Menu bar look under "Tools" and select "Manage Addons".
A configuration window should start, select under the section marked "Add-on Types" the button for "Toolbars and Extensions" (Should Default to this button).  Look at the frame to the right and find "Adobe PDF Link Helper" and ensure that it is enabled.

If you feel that perhaps somthing may have hijacked your system, I would suggest visiting the bleepingcomputer.com site (yea I know it sounds like a crazy name, but  a lot of folks there can help).
On their Home page they give you the steps you need to follow in order to expedite your help question to the masses.

@CyberMaxX: Many thanks for the Adobe link. When I have time, i'm gonna use it & see if I can learn more about the Acrobat Reader.

No problem, and glad to help.

Cheers
CyberMaxX

When I fdisked, it was a fresh install. The virus cut-off my access to everything, including System Restore. I had to full start over, & I had nothing backed up, thus lost everything. It was after this fdisk that I got sick & tired of losing EVERYTHING everytime something like this happened & I finally have remedied the problem by getting 2 USB Flash Drives. (1 2GB & 1 4GB)

I did a Search on my puder for the .pdf extension and got 11 - 12 results that oddly, don't show any .pdf extension on it. They are all for Adobe Acrobat Reader V7.0. (Once again reminds me of why I had previously thought it was outta date, Isn't it supposed to be on V9.0 now or somewhere around there?) I tried opening one that had a name called somethin like 'manual' & it opened that Adobe Acrobat Reader pop-up yet again. It's the same one that virused me before. It's an official lookin pop-up window that looks like a license agreement that I have to click 'Accept' to proceed on. The last time I clicked that 'Accept' button, I lost my puder.

I searched Tools - Internet Options - Pop-Up Blocker Settings & it's 'allowed' list only had 3 Bioware sites, 1 Spore site, 1 McAfee site, & 1 Yahoo site on it. I've deleted the Yahoo site off of there. If it turned out to be safe & I encounter it later, I can re-add it.

I searched Tools - Manage Addons - Addon Types - Toolbars & Extensions. The 'Adobe PDF Link Helper' addon you specified is completely absent from the list. Is this an alarm bell?

Don't know if this is relevant or not, but just in case, I too have XP Service Pack 3. My Motherboard Drivers require at least Service Pack 2 at minimum to run at full power for some wierd reason. (M3A-H/HDMI Motherboard, which i'm never using again in any future puder. Onboard Graphics Chip & it's lack of dedicated video memory not only stinks, but is the single biggest reason my puder failed it's Windows 7 Compatibility test.  Next puder upgrade, i'm goin back to Graphics Cards!)

[CyberMaxX]

Tyrax Lightning wrote...

When I fdisked, it was a fresh install.

OK good to know, plus I agree that's a real drag when that happens.

I did a Search on my puder for the .pdf extension and got 11 - 12 results that oddly, don't show any .pdf extension on it.

That's ok, there's an option for Explorer to Show or Hide known extensions... you probably have it set to hide, which is default.

They are all for Adobe Acrobat Reader V7.0. (Once again reminds me of why I had previously thought it was outta date, Isn't it supposed to be on V9.0 now or somewhere around there?)

When you get the chance visit adobe.com and download the latest Adobe Reader Software.  Yes it's V9.0 so it looks like your Reader is way out of date. 

I tried opening one that had a name called somethin like 'manual' & it opened that Adobe Acrobat Reader pop-up yet again. It's the same one that virused me before. It's an official lookin pop-up window that looks like a license agreement that I have to click 'Accept' to proceed on. The last time I clicked that 'Accept' button, I lost my puder.

I would say if you install the newer V9.xx version from the adobe site, and during the install you accept their license agreement, you won't see the popup anymore.  It would be wise to run the latest version, to many exploits out there against the older versions of Adobe Reader.

I searched Tools - Internet Options - Pop-Up Blocker Settings & it's 'allowed' list only had 3 Bioware sites, 1 Spore site, 1 McAfee site, & 1 Yahoo site on it. I've deleted the Yahoo site off of there. If it turned out to be safe & I encounter it later, I can re-add it.

That's good keep it slim and trim, check that once in a while to make sure your settings weren't hijacked.  If you see a site your not sure of delete it from the list. Like you said, if you go back to the site and IE pop's a message about it blocking a popup and you chose to Always Allow Popups from this site, it will repopulate itself back into the list.

I searched Tools - Manage Addons - Addon Types - Toolbars & Extensions. The 'Adobe PDF Link Helper' addon you specified is completely absent from the list. Is this an alarm bell?

Probably because your running an older version which used the MIME Application/Type to launch Adobe Reader. The newer version uses BHO (Browser Helper Object) to help the Browser launch the file within itself.

Don't know if this is relevant or not, but just in case, I too have XP Service Pack 3. My Motherboard Drivers require at least Service Pack 2 at minimum to run at full power for some wierd reason. (M3A-H/HDMI Motherboard, which i'm never using again in any future puder. Onboard Graphics Chip & it's lack of dedicated video memory not only stinks, but is the single biggest reason my puder failed it's Windows 7 Compatibility test.  Next puder upgrade, i'm goin back to Graphics Cards!)

XP SP3 is tried and true, I would agree about avoiding built in Graphics cards though on your next computer, I dislike them for the same reason.

See if installing the new Adobe Reader Software from Adobe's own site, corrects the issue about the popup windows.  Then try again the Dragon Age:Origin Posters.  Those files are safe, and one you put the new version of Adobe Reader on your system.  Depending on how you have your IE popup Blocker settings you may or may not be warned about IE stopping a popup window.  If you select Temporarily Allow, then all IE will do is start another window of itself and load the POSTER directly into an Adobe Reader Frame within itself.

Hope the information helps
Cheers
CyberMaxX

[Tyrax Lightning]

CyberMaxX wrote...

Tyrax Lightning wrote...

When I fdisked, it was a fresh install.

OK good to know, plus I agree that's a real drag when that happens.

I did a Search on my puder for the .pdf extension and got 11 - 12 results that oddly, don't show any .pdf extension on it.

That's ok, there's an option for Explorer to Show or Hide known extensions... you probably have it set to hide, which is default.

They are all for Adobe Acrobat Reader V7.0. (Once again reminds me of why I had previously thought it was outta date, Isn't it supposed to be on V9.0 now or somewhere around there?)

When you get the chance visit adobe.com and download the latest Adobe Reader Software.  Yes it's V9.0 so it looks like your Reader is way out of date. 

I tried opening one that had a name called somethin like 'manual' & it opened that Adobe Acrobat Reader pop-up yet again. It's the same one that virused me before. It's an official lookin pop-up window that looks like a license agreement that I have to click 'Accept' to proceed on. The last time I clicked that 'Accept' button, I lost my puder.

I would say if you install the newer V9.xx version from the adobe site, and during the install you accept their license agreement, you won't see the popup anymore.  It would be wise to run the latest version, to many exploits out there against the older versions of Adobe Reader.

I searched Tools - Internet Options - Pop-Up Blocker Settings & it's 'allowed' list only had 3 Bioware sites, 1 Spore site, 1 McAfee site, & 1 Yahoo site on it. I've deleted the Yahoo site off of there. If it turned out to be safe & I encounter it later, I can re-add it.

That's good keep it slim and trim, check that once in a while to make sure your settings weren't hijacked.  If you see a site your not sure of delete it from the list. Like you said, if you go back to the site and IE pop's a message about it blocking a popup and you chose to Always Allow Popups from this site, it will repopulate itself back into the list.

I searched Tools - Manage Addons - Addon Types - Toolbars & Extensions. The 'Adobe PDF Link Helper' addon you specified is completely absent from the list. Is this an alarm bell?

Probably because your running an older version which used the MIME Application/Type to launch Adobe Reader. The newer version uses BHO (Browser Helper Object) to help the Browser launch the file within itself.

Don't know if this is relevant or not, but just in case, I too have XP Service Pack 3. My Motherboard Drivers require at least Service Pack 2 at minimum to run at full power for some wierd reason. (M3A-H/HDMI Motherboard, which i'm never using again in any future puder. Onboard Graphics Chip & it's lack of dedicated video memory not only stinks, but is the single biggest reason my puder failed it's Windows 7 Compatibility test.  Next puder upgrade, i'm goin back to Graphics Cards!)

XP SP3 is tried and true, I would agree about avoiding built in Graphics cards though on your next computer, I dislike them for the same reason.

See if installing the new Adobe Reader Software from Adobe's own site, corrects the issue about the popup windows.  Then try again the Dragon Age:Origin Posters.  Those files are safe, and one you put the new version of Adobe Reader on your system.  Depending on how you have your IE popup Blocker settings you may or may not be warned about IE stopping a popup window.  If you select Temporarily Allow, then all IE will do is start another window of itself and load the POSTER directly into an Adobe Reader Frame within itself.

Hope the information helps
Cheers
CyberMaxX

Ahh, so on my last install, it's lookin like my out of date Acrobat Reader may have caused my downfall then. That's painful, at the time, it had been only running for 2-3 weeks. (I was still recovering from a virus defeat. It was getting virus defeated again before I had even fully recovered from a prior virus defeat that had especially ed me off.) It would definitely be like me to have completely forgotten to re-update my Adobe Acrobat Reader, since I only use it occasionally.

My yahoo permission is back up. It didn't take long for it to reappear & turn out to be safe. I forgot that the yahoo pop-up permission was for pop-up use for my Yahoo Mail Contacts List. I email mostly family & friends & add their email to the 'To:' field via the Contacts List since my memory is a wuss & too easily forgets their email addresses.

I have my IE8 Settings set so that when it blocks a pop-up, it drops a little yellow info window telling me so, partially so I know how often it's succeeding, partially because I wanna know if something tries to pop-up me when i'm not expecting it, & partially to know if a pop-up I do want is accidentially bein blocked so I don't accidentially think a program or such is malfunctioning. (ie I wanna know if a link is failing to open because it's trying to open as a pop-up & getting blocked so I don't accidentially mistakenly think the link is broken by mistake.)

My mom got this motherboard & CPU for me when my prior motherboard & cpu blew up. (No surprise, since it was years old & bound to go anytime.) She saw the onboard graphics chip feature & figured it would be a cool way to not need a graphics card. Though my experience at it's use, I now know they don't work too well in practice & have warned her to avoid them in the future. It looks like Graphics Cards are stayin king of the graphics hill for plenty more years to come. Lack of dedicated video memory + lack of upgrade capability = they lose.

I deeply apologize to the Site Devs. It appears that i've caused an accidential false alarm.  I solemly swear it wasn't intentional. I hope CyberMaxX's sweet info makes this thread not a waste of time.

I nominate CyberMaxX for poster of the year!

An Adobe Acrobat Reader info sticky might be an option to consider in case others have had troubles like mine as well. The Adobe Acrobat Reader is an outta the way, easily forgotten program.

Edit: A fat lotta good it does me to proofread, my proofreading still keeps missing mistakes that have to be caught later anyway.

Modifié par Tyrax Lightning, 29 novembre 2009 - 11:52 .

[Tyrax Lightning]

Woohoo! I now have Adobe Acrobat Reader (Or is it supposed to be referred to as just Adobe Reader? I don't see Acrobat in it's name anymore.) V9.2! I hope this closes a puder security threat. I tried the poster download again & this time it goes straight to an Adobe Reader window with the poster popped right in to be saved to my puder.



Now, what the buggers is this Acrobat.com thing the Adobe site is trying to entice me to subscribe to?

[Tyrax Lightning]

It's gonna take awhile to get the hang of Adobe Reader:



With that said, I find myself wondering if this thread's job is done?

Modifié par Tyrax Lightning, 30 novembre 2009 - 02:46 .

[Jesse van Herk]

Definitely not a virus, as that's a legitimate pdf. Renamed the thread accordingly to avoid FUD.

[Tyrax Lightning]

Jesse van Herk wrote...

Definitely not a virus, as that's a legitimate pdf. Renamed the thread accordingly to avoid FUD.

Many thanks. I forgot to think of that once the issue was resolved.